CCNA NAT Questions

Candidates think that seeing the same global port means overload is not operating, but port reuse is normal in extended PAT.

Candidates may misinterpret the summary line as a static identity NAT rule that locks all translations to a single port.

Candidates confuse pool exhaustion (no free global addresses) with port reuse. Exhaustion typically manifests as translation failures, not as many entries sharing the same port.

The specific factual error: The inside/outside interface roles are reversed; PAT is applied to the wrong interface.

The specific factual error: The ACL does not match the inside network, so PAT will not be applied to LAN traffic.

The specific factual error: The PAT command uses the wrong ACL number; it should use ACL 1, not ACL 2.

The symptom described is that external hosts cannot initiate connections to internal hosts. Even if the NAT pool were exhausted, internal hosts would still be able to initiate outbound connections (using PAT if configured), and external hosts would still be unable to initiate inbound connections unless static NAT or port forwarding is configured. Pool exhaustion would cause outbound failures, not specifically inbound failures.

The inside local addresses (192.168.1.x) are private IPs that are typically configured on the inside interface. The NAT translations show them mapping to public IPs, indicating that the router is correctly performing NAT. Asymmetric routing would cause connectivity issues in both directions, not just inbound, and is not indicated by the given symptoms.

The question states that internal hosts can ping external servers, which means return traffic is reaching the internal hosts. If the outside global addresses were not routable, the ping would fail because the external server would not be able to send a reply. Therefore, the addresses must be routable in this scenario.

A common misconception is that any dynamic NAT entry for the same inside local address takes precedence or conflicts with static entries. In reality, the more specific static mapping takes priority for matching traffic, and the dynamic entry handles unrelated flows.

Candidates may misinterpret the presence of the same inside local IP in two entries as a duplicate session. Asymmetric routing would require inconsistent state in both directions, but here the NAT table correctly tracks distinct flows.

Some candidates believe that a single inside address can only participate in one type of NAT at a time. In fact, multiple NAT rules can coexist, and the router will use the most specific match (static port mapping) before falling back to dynamic PAT for unmapped ports.

The specific factual error is that the inside and outside interfaces are swapped; G0/0 is the internal interface and must be 'ip nat inside'.

The specific factual error is that the ACL permits the wrong subnet (192.168.2.0 instead of 192.168.1.0).

The specific factual error is that both the interface directions are swapped and the ACL is changed, but the interface directions must be correct for NAT to work.

The specific factual error is that the pool address 203.0.113.2 and static mapping to 203.0.113.3 are valid and do not need changing.

The specific factual error is that PAT does not allow inbound connections initiated from outside; static NAT is required for that purpose.

The specific factual error is that the inside interface IP is part of the 192.168.1.0/24 network and should not be changed; the ACL should be adjusted instead.

The ACL used by NAT should match the inside local addresses that need to be translated, typically using a permit statement. If the ACL denies inside addresses, no traffic will be matched for translation, causing NAT to fail. The correct ACL should permit the inside network.

PAT (Port Address Translation) does not require DHCP on any interface. PAT translates multiple private IP addresses to a single public IP using different port numbers, and it works independently of how IP addresses are assigned. DHCP is only needed if the interface needs to obtain an IP address dynamically.

NAT overload (PAT) is independent of the routing protocol used. It works with static routes, OSPF, EIGRP, or any other routing protocol. The routing protocol only affects how packets are forwarded, not how NAT translates addresses.

Candidates think any absence of dynamic entries is due to ACL mismatch, overlooking the prerequisite that the inside interface must be configured with ip nat inside for NAT to function at all.

The presence of static NAT translations in the output indicates that the ip nat outside command is already applied on the WAN interface.

Candidates may focus on the static entries, but the symptom is missing dynamic translations; bad static mappings would not prevent dynamic translations from appearing.

The access list is used to define which inside local addresses are eligible for NAT. If the access list were misconfigured, the router would not create translations for those hosts. However, the scenario states that translations are present, indicating that the access list is correctly matching the internal hosts.

If the outside interface were missing the 'ip nat outside' command, the router would not perform NAT on outbound traffic at all, resulting in no translations being created. Since translations are present, this command is correctly configured.

Similar to option C, if the inside interface were missing the 'ip nat inside' command, no translations would be created. The presence of translations indicates that the inside interface is correctly configured.

IPv6 extension headers are used for additional functionality in IPv6 packets, such as fragmentation or security, and are not involved in NAT overload (PAT) which operates at Layer 4 using port numbers.

Source MAC addresses are used for Layer 2 forwarding within a local network and are not preserved across a router's WAN interface; NAT operates at Layer 3 and above, not using MAC addresses for translation.

Routers do not maintain separate routing tables per client; routing tables are based on destination networks, not individual hosts. NAT overload uses a single routing table and relies on port numbers for translation.

Option A incorrectly identifies the inside global address as the private IP address assigned to the internal PC. This is actually the inside local address, which is the private IP used within the internal network and not visible externally.

Option C confuses the inside global address with outside local or outside global addresses, which refer to remote servers or external hosts from the internal perspective. The inside global address specifically represents the internal PC externally.

Option D incorrectly associates the inside global address with the MAC address of the outside interface. NAT translation deals with IP addresses and ports, not MAC addresses, so this option is invalid.

The already-configured ACL permits all IP traffic, so explicitly allowing port 443 would not resolve a server not listening on that port. This step wastes time on a verified configuration.

Static NAT does not use dynamic overload entries. There are no conflicting entries because NAT overload is not configured, making this check irrelevant.

The fact that port 80 works shows the inside global IP is correct. Re-verifying it would not explain the port-specific failure, as the issue is not with the translation.

The ACL must match the source subnet of the inside hosts that need translation; using 192.168.2.0/24 does not match 192.168.1.0/24.

The 'overload' keyword is essential for PAT; omitting it means only one inside host can use the outside IP at a time.

NAT requires one interface to be 'inside' and the other 'outside'; having both as 'inside' prevents translation of outbound traffic.

The specific factual error: The inside/outside interface assignment is reversed; ACL 10 permits 10.0.0.0/8 instead of 192.168.1.0/24.

The specific factual error: The inside/outside interface assignment is reversed; the WAN interface should be outside, not inside.

The specific factual error: The 'overload' keyword is missing, which is required for PAT to enable many-to-one translation.

The static NAT entry is correct; the inside address 192.168.10.100 is properly mapped to 203.0.113.5.

Static NAT requires a separate public IP to avoid overlapping with PAT translations. The public IP 203.0.113.5 is appropriate.

The static NAT entry is correctly configured with 192.168.10.100 and 203.0.113.5; the error is solely in the ACL and missing overload keyword.

PAT works with any transport protocol that has port fields—TCP, UDP, and even ICMP through the identifier field.

Only dynamic translations (from dynamic NAT or PAT) have idle timeouts; static mappings are permanent.

This statement describes dynamic NAT pool exhaustion, not PAT, which uses port multiplexing.

The ACL must match the inside network; permitting a different subnet will not translate traffic from the correct LAN.

The NAT inside/outside designation is based on the direction of traffic; the interface facing the public network must be outside.

Without 'overload', the router will not use port numbers to multiplex multiple inside hosts to a single public IP.

The NAT interface directions are reversed; the internal-facing interface must be 'ip nat inside' and the external-facing interface must be 'ip nat outside'.

Static NAT for services must include the protocol (tcp/udp) and port number to map specific services; otherwise, it maps the entire IP address, which is not desired here.

The 'ip nat outside source static' command is used for translating the source address of inbound packets (e.g., for load balancing), not for mapping a public IP to an internal server. For inbound access to servers, 'ip nat inside source static' is required.

The pool range includes 10.0.0.2 (the ISP's IP) and lacks the overload keyword, so PAT is disabled.

The ACL permits all traffic (any) and the inside/outside interfaces are reversed.

This uses interface overload instead of a NAT pool, contradicting the pool requirement.

PAT does not require a 1:1 mapping; it allows many internal addresses to share a single public IP. A 1:1 mapping is characteristic of static NAT, not PAT.

PAT can be configured with either a single public IP address (using the interface address) or a pool of public IP addresses. It does not require a pool; a single address is sufficient for PAT overload.

PAT translations are dynamic and have a timeout (default 86400 seconds for general translations, but shorter for TCP/UDP). They are removed after the session ends or the timeout expires.

The specific factual error is that the interface facing the outside (public) network is incorrectly configured as 'ip nat inside'.

The specific factual errors are: 1) The ACL does not match the correct inside network. 2) The 'overload' keyword is omitted, preventing PAT from working.

The specific factual error is that the static NAT command includes protocol and port, limiting the translation to TCP port 80 only.

Denying the inside subnet in the ACL would prevent any NAT translation from occurring, which would block all inside hosts from reaching the internet, not just limit access to one at a time.

Reversing inside and outside interface roles typically stops NAT from functioning entirely rather than allowing only one host at a time. The symptom points more directly to missing overload.

NAT is specifically designed to translate RFC1918 private IP addresses to public IP addresses. Saying NAT cannot be used with RFC1918 addresses is incorrect and contradicts common practice.

The specific factual error is that the interface with the public IP (203.0.113.1) must be configured as 'ip nat outside', not 'ip nat inside'. Marking it as inside would cause asymmetric NAT behavior and break translation.

The specific factual error is that PAT requires the 'overload' keyword. Without it, the router performs dynamic NAT (one-to-one translation), which would not support multiple hosts sharing a single public IP.

The specific factual errors are: (1) the interface with the public IP must be 'ip nat outside', and (2) PAT requires the 'overload' keyword. Both are violated here.

The command 'ip nat inside source list ... interface ... overload' uses the interface's IP address for translation, not the pool address 203.0.113.1. The requirement specifies using the public IP 203.0.113.1, which is assigned to the interface but may not be the interface's primary IP if multiple IPs are configured.

Without 'overload', the router will attempt to allocate a unique public IP for each internal session, but the pool has only one IP, so only one translation can exist at a time. PAT (overload) is required to allow multiple internal hosts to share the single public IP.

The 'ip nat inside' command should be on the LAN interface (GigabitEthernet0/1) and 'ip nat outside' on the internet-facing interface (GigabitEthernet0/0). Reversing them causes NAT to fail because the router does not know which traffic is internal.

This option is incorrect because the ISP-facing interface is correctly configured as ip nat outside. The problem is not with the interface NAT designation but with the ACL mismatch. Changing the inside interface designation would not fix the translation issue.

This option is incorrect because NAT overload commonly uses the IP address of the outside interface as the translated source address. This is standard Cisco NAT behavior and not a cause of failure in this scenario.

This option is incorrect because NAT does not depend on routing protocols like OSPF to function. NAT translation is independent of routing protocols, so running OSPF is not required for NAT overload to work.

This option is incorrect because it describes PAT behavior, where multiple inside users share a public IP via port overload. Static NAT does not share the public address among users.

This option is incorrect because the internal server still requires a valid IP address on the internal network for routing and communication; static NAT does not remove this requirement.

This option is incorrect because NAT translates addresses but does not eliminate the need for routing. Proper routing is still necessary to deliver packets to the internal server.

The answer fails to include the verification step, which is a critical part of troubleshooting and ensuring the configuration is applied correctly.

The ACL must match the correct inside network; without fixing it, PAT will not apply to the intended traffic.

The 'overload' keyword is essential for PAT; omitting it means the router will perform dynamic NAT without port translation, which is insufficient for multiple hosts.

Option A is incorrect because the ACL used for NAT must permit the inside local subnet (192.168.20.0/24) to allow translation. Denying this subnet would block NAT translation, but the question states the ACL permits it, so this is not the cause.

Option C is incorrect because a /30 WAN link is commonly used in point-to-point connections and does not prevent PAT from functioning. PAT works independently of the WAN subnet size.

Option D is incorrect because NAT overload can be configured using a standard ACL; a route-map is optional and not required. The absence of a route-map does not cause the connectivity issue described.

Incorrect. The interface facing the ISP is typically marked with ip nat outside, not ip nat inside, because it represents the public or external side of the NAT boundary.

Incorrect. Not every routed interface requires NAT configuration. Only interfaces that participate in NAT translation should be marked as inside or outside to define the translation boundaries.

Incorrect. NAT is not limited to loopback interfaces, and loopbacks are generally not used for NAT inside or outside designation since NAT operates on interfaces connected to real networks.

Only one public IP is available, so a pool cannot be created.

Inbound access to the web server would not be possible without a static mapping.

Internal hosts would not be able to access the internet because they lack public IP assignments.

This option is wrong because 203.0.113.10 is the inside global address, not the inside local address. The inside local address is 192.168.10.25, which is correctly identified in option A.

This option is incorrect because 198.51.100.20 is the outside local address, not a translated private address. The inside local address is specifically 192.168.10.25, as indicated in the NAT translation entry.

This option is incorrect because the entry shows that 203.0.113.10 is the inside global address, not the inside local address. The inside local address is 192.168.10.25, which is correctly identified in option A.

PAT overload is incorrect because it is designed for many internal clients sharing a single public IP for outbound traffic, not for providing a fixed public IP to a server.

No NAT is incorrect since private IPv4 addresses are not routable on the Internet and require NAT to be accessible externally.

DHCP relay is unrelated to NAT or public reachability; it only forwards DHCP requests and does not affect how internal servers are accessed from outside.

Incorrect. The ACL in NAT configurations is used to identify which inside addresses to translate, not to filter or deny traffic. Denying RFC1918 traffic in the ACL is unnecessary and unrelated to the NAT failure described.

Incorrect. Using the outside interface IP address for PAT overload is a standard and supported practice in Cisco NAT configurations. This option does not explain the return traffic failure.

This option is incorrect because PAT overload uses a different command syntax involving 'overload' and allows many internal hosts to share one public IP, which is not the case here.

This option is wrong since static NAT does not inherently block inbound access; instead, it enables external hosts to reach the inside host via the mapped public IP.

This option is incorrect because NAT translation does not modify the subnet mask of the inside host; it only changes the IP address seen externally.

Candidates may confuse security inspection with NAT translation, assuming that a protocol‑specific inspection is needed for HTTP.

Tempting because an ACL could selectively block TCP; however, the question provides context about the renumbering, which directly points to the NAT configuration.

Candidates may assume that different protocols might take different paths, but a single default route applies uniformly to all IP traffic.

The static NAT command syntax is 'ip nat inside source static [inside-local] [inside-global]'. Here, the inside local (private) should be 172.16.1.100 and inside global (public) should be 10.0.0.3. Also, the inside interface is the one facing the internal network (G0/1) and outside is facing the ISP (G0/0).

NAT requires that the interface facing the internal network be marked as 'ip nat inside' and the interface facing the external network be marked as 'ip nat outside'. Here, G0/0 connects to the ISP (outside) and G0/1 connects to the internal network (inside).

The command 'ip nat outside source static' translates the source address of packets arriving on the outside interface. For translating internal host addresses to a public IP, 'ip nat inside source static' must be used.

Candidates may focus on Hits: 0 and Misses: 15042 as typical of an ACL issue, but the explicit interface binding in the dynamic mapping is the direct evidence of misconfiguration.

The high CEF Punted count mirrors the misses, leading some to believe CEF is the problem, but the exhibit does not indicate CEF is disabled.

Candidates might assume that a high miss count reflects a full translation table, but the total active translations show 0.

The specific factual error is that the static NAT inside address is already correct; altering it is unnecessary and incorrect.

The specific factual error is that static NAT is required for inbound access; PAT alone cannot provide a fixed public-to-private mapping.

The specific factual error is that interface NAT direction is fundamental; if inside/outside are reversed, NAT translations will not be applied correctly.

An empty NAT table indicates no translation is happening at all, which is not the expected outcome of simply reversing inside/outside roles—NAT still processes packets but incorrectly.

Complete internet unreachability is a generic connectivity symptom that could be caused by routing, firewall, or other NAT issues, but does not strongly signal a role reversal.

External hosts connecting to a private IP without translation is a typical sign of a missing static NAT or PAT rule, not of reversed interface direction assignments.

Uses the outside interface IP (10.0.0.1) instead of the required 203.0.113.18.

The translation command uses the inside interface, which would not provide the correct source address for outbound traffic.

Missing the 'overload' keyword, so only one-to-one NAT occurs, preventing multiple hosts from sharing the IP.

The specific factual error is that the 'ip nat inside' and 'ip nat outside' commands are applied to the wrong interfaces. The inside interface must be the one facing the internal network, and the outside interface must be the one facing the external network.

The specific factual error is that the ACL does not match the correct inside network. The ACL in the NAT configuration must permit the exact private IP range used on the inside network.

The specific factual error is the omission of the 'overload' keyword. PAT (overload) is required to allow multiple inside hosts to share a single public IP address by using different source ports.

Option C is incorrect because dynamic NAT does not guarantee a fixed public IP address for any inside host, so it cannot reliably support inbound access without additional static configuration.

Option D is incorrect because NAT and PAT are directly related to enabling private IP addresses to communicate with the public internet, making them central to edge router configurations in branch offices.

Applying 'ip nat enable' on both interfaces is incorrect because Cisco IOS uses 'ip nat inside' and 'ip nat outside' to define NAT roles. The problem is not enabling NAT but assigning the correct directional roles to interfaces.

Replacing 'overload' with a pool is unnecessary since PAT uses 'overload' to allow multiple inside hosts to share one outside IP. The issue is not the translation method but the reversed inside/outside interface roles.

Changing access-list 1 to a standard ACL numbered 100 does not address the core problem. ACL 1 is valid for identifying inside local addresses, and the failure is due to reversed NAT interface roles, not the ACL number.

NAT pool size is not a limiting factor with PAT overload; a single address can serve thousands of hosts.

The interface is correctly configured for NAT inside.

Applying multiple access lists to the same pool is allowed and does not create a conflict.

The 'ip nat inside source list' command must specify the outside interface (the one with the public IP) for translation, not the inside interface.

NAT overload (PAT) requires the 'overload' keyword to enable port address translation. Without it, the router performs dynamic NAT, which is insufficient for sharing a single public IP among many hosts.

The ACL should match only the internal network that requires translation. Using 'permit any' would translate all traffic, including traffic that should not be translated, potentially breaking connectivity or causing security risks.

The ACL must match the entire inside network (192.168.10.0/24), not just the server IP.

The overload keyword is required to enable PAT (port address translation) for sharing a single public IP among multiple inside hosts.

The interface facing the internet must be configured as ip nat outside; inside interfaces are those facing the internal network.

A default route on the inside host controls outbound traffic, not inbound connections from the internet.

PAT overload is used for many-to-one translation and would not block inbound traffic if static NAT is already configured.

DHCP relay forwards DHCP requests to a remote server and does not affect inbound HTTP/HTTPS access to a web server.

PAT overload is incorrect because it is designed for many internal hosts sharing a single public IP for outbound traffic, not for providing a fixed public IP for inbound server access.

No NAT is incorrect since private IPv4 addresses are not routable on the public Internet; without NAT, the internal server cannot be reached from outside the private network.

DHCP relay is unrelated to NAT or public reachability; it only forwards DHCP requests across subnets and does not provide any public IP mapping for internal servers.

Static NAT for every host is incorrect because it requires a unique public IP address per internal host, which is inefficient and unnecessary when only outbound access is needed without inbound server publishing.

No NAT is incorrect because private IPv4 addresses are not routable on the public Internet and must be translated to public addresses to communicate externally.

DHCP relay is incorrect because it only forwards DHCP messages between clients and servers and does not perform any IP address translation or NAT functions.

The access list correctly matches the internal subnet, so this is not the root cause.

Even without overload, dynamic NAT should work for the first 11 hosts; the problem is that return packets are not being translated.

The pool size is not the issue; the router is not translating return traffic due to missing 'ip nat outside'.

The scenario explicitly mentions successful pings to IP addresses, so name resolution is not the cause.

The command output explicitly shows 'overload', and the symptom (ping works, TCP fails) is inconsistent with a missing overload keyword.

A static NAT conflict would affect all traffic (including ICMP), not just web traffic.

Static NAT provides a fixed one-to-one mapping between private and public IP addresses. It does not use port numbers to allow multiple inside hosts to share a single public IP, so it cannot fulfill the requirement of the question.

NTP authentication secures Network Time Protocol messages and is unrelated to address translation or NAT. It does not allow multiple hosts to share a public IP address.

Port security controls which MAC addresses can access a switch port to enhance Layer 2 security. It does not perform IP address translation or use port numbers to share public IP addresses.

Static NAT only provides a one-to-one mapping between private and public IP addresses, so it cannot support multiple internal users sharing one public IP address simultaneously, making it unsuitable for the scenario.

No NAT is incorrect because private IPv4 addresses are not routable on the public Internet; without NAT, internal users cannot access external resources using private IPs alone.

DHCP relay is unrelated to NAT or IP address translation; it simply forwards DHCP requests between clients and servers and does not enable sharing of public IP addresses for Internet access.